France accuses Iran of supermarket fridge hacking

French Foreign Minister Jean-Noël Barrot said the October 11 attack was "unprecedented in both its scale and its level of aggression" and marked the first large-scale cyberattack aimed at sabotage on French national territory. He added that France has summoned Iran's ambassador and intends to impose retaliatory sanctions "at a European level." The Paris prosecutor's office opened a judicial investigation targeting the head of Shahid Kaveh, described as a cyber-offensive unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps, along with two deputies.

According to the prosecutor's office, hackers gained remote control of refrigeration equipment via web interfaces, initiating indefinite defrost cycles while disabling safety alerts. Temperatures in some units reportedly rose to 50°C (120°F) overnight. The attack struck major chains including Coopérative U, Intermarché, Netto, Carrefour, Monoprix and E.Leclerc, targeting software provided by Danish firm Danfoss. The prosecutor's office said the investigation uncovered a methodology characteristic of the Iranian unit, including the use of the Persian (Farsi) language and IP addresses tracing back to devices in Iran.

Weeks after the French incident, similar hacks affected supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, hitting more than 100 stores across Europe. A separate cyberattack also targeted several blood banks in France, though products and samples were not damaged. In August, refrigeration outages at six U.S. military bases sparked an investigation by the Department of the Army Criminal Investigation Division. Officials in France, the U.S. and other European nations have not asserted that all incidents are connected.

The FBI's cybercrime branch said it was seeing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems worldwide, warning that security weaknesses in unpatched or internet-accessible controllers can allow attackers to change system settings. The FBI urged organizations to take controllers off the public internet and keep access behind a firewall. Iranian authorities have not responded to the French allegations, though the regime has threatened for months to expand retaliation for the war launched by the U.S. and the ongoing U.S. naval blockade of its ports using unspecified, asymmetrical means.